Security & Privacy Notice

The General Data Protection Regulation 2016 (GDPR) is one of the new pieces of legislation affecting the way that we carry out our information processing activities. Significant fines are applicable if a breach is deemed to have occurred under the GDPR, which is designed to protect the personal data of citizens of the European Union. It is our policy to ensure that our compliance with the GDPR and other relevant legislation is clear and demonstrable at all times.

The data subject – i.e. you - also has rights under the GDPR. These consist of:

1. Your right to be informed
2. Your right of access
3. Your right to rectification
4. Your right to erasure
5. Your right to restrict processing
6. Your right to data portability
7. Your right to object
8. Your rights in relation to automated decision making and profiling.

Each of these rights are supported by appropriate procedures within Bluebella that allow the required action to be taken within the timescales stated in the GDPR.

These timescales are as follows:

There are six alternative ways in which the lawfulness of a specific case of processing of personal data may be established under the GDPR. It is our policy to identify the appropriate basis for processing and to document it, in accordance with the Regulation. Three of the six options that apply to us are described briefly as follows:

1. Consent
   Unless it is necessary for a reason allowable in the GDPR, we will always obtain explicit consent from you to collect and process your data. Transparent information about our usage of your personal data will be provided to you at the time that consent is obtained and your rights with regard to your data explained, such as the right to withdraw consent. This information will be provided in an accessible form, written in clear language and free of charge.
2. Performance of a Contract
   Where the personal data collected and processed are required to fulfil a contract with you, explicit consent is not required. This will often be the case where the contract cannot be completed without the personal data in question e.g. we can't deliver to you without an address to deliver to.
3. Legitimate Interests
   If the processing of specific personal data is in the legitimate interests of Bluebella and is judged not to affect the rights and freedoms of the data subject in a significant way, then this may be defined as the lawful reason for the processing. The reasoning behind this view will be documented.

We may periodically send emails about new products, special offers or other information which we think you may find interesting using the email address which you have provided.

From time to time, we may also use your information to contact you for market research purposes. We may contact you by email, phone, fax or mail. We may use the information to customise the website according to your interests.

Customer and order information is processed by Shopify Inc., which is based in the United States.

SHARING YOUR INFORMATION

We do not disclose any personal data you provide to any third parties other than as follows:

• If you place an order personal information relevant to your delivery will be provided to our shipping partner;
• We may host personal data with third party hosting partners;
• Certain third party suppliers including technical support providers may have access to personal data;
• where we carry out research to gain an insight into the use of our services, the results of this research (but not your personal data itself) may be transferred to interested third parties;
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation (for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime);
• in order to enforce any terms and conditions or agreements for our services that may apply;
• we may transfer your personal information to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation, but we will take steps with the aim of ensuring that your privacy rights continue to be protected;
• to protect our rights, property and safety, or the rights, property and safety of our users or any other third parties. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
• We sometimes make our mailing list available to third party companies whose products we thought might interest you. Occasionally we may also make our mailing list available to established charities. We reach these other companies and charities directly or via a data co-operative. A data co-operative collects data and customer information across a range of different retailers. The data co-operative then analyses that information to help the participating companies tailor their communications. The data co-operatives may also use the customer information for their own marketing or commercial purposes. To opt out of sharing your personal data with third parties, please email our Data Protection team at customercare@bluebella.com

Other than as set out above, we shall not disclose any of your personal information unless you give us permission to do so . If we do supply your personal information to a third party we will take steps to ensure that your privacy rights are protected and that third party complies with the terms of this notice.

MARKETING & PRIVACY PREFERENCES

Full details of our privacy policy are below but you can manage your marketing preferences here:

• UNSUBSCRIBING FROM OUR CATALOGUES:
  From time to time we will send you catalogues and promotions by post. If you no longer wish to receive postal mailings from us, email customercare@bluebella.com with your name & postal address, which can be found on the back of your latest catalogue.
  Please note catalogues are printed in advance so you may receive one further mailing after opting out.
• UNSUBSCRIBING FROM OUR NEWSLETTERS:
  We will ask you for your email address so that we can send you an order confirmation and any further delivery information. From time to time we will send you special offers and promotions. If you no longer wish to receive these promotions, please click on the unsubscribe link at the bottom of the email, or contact please email customercare@bluebella.com
• UNSUBSCRIBING FROM OUR MESSAGING:
  We will ask you for your phone number so that we can send you special offers and promotions. If you no longer wish to receive these messages, please text the keyword STOP to our shortcode to opt out of receiving our text messages.
• CAN I GO BACK ON YOUR MAILING LIST?
  If you have previously asked us not to send catalogues and promotions by post or email but have changed your mind, you can resubscribe to email newsletters by signing up again via the website signup form. For promotions by post please email customercare@bluebella.com.
• OPTING OUT OF THIRD PARTY MAILINGS
  If you no longer want third party mailings, please email customercare@bluebella.com with your name and address.
• DO NOT SELL MY INFORMATION
  You have the right to request not to sell your personal information that we have collected and will process your request in 15 days and notify any relevant third parties. You opt back in at anytime using the same email address as opting out. Make your request by emailing our Data Protection team at customercare@bluebella.com.
• DELETION OF PERSONAL INFORMATION
  You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. We will delete, and direct our service-providers to delete, your personal information from our records, unless an exception applies. You can make your request by emailing our Data Protection team at customercare@bluebella.com.

SECURITY

We will take all reasonable steps to ensure that appropriate technical and organisational measures are carried out in order to safeguard the information we collect from you and protect against unlawful access and accidental loss or damage. These measures may include (as necessary):

• protecting our servers by both hardware and software firewalls;
• locating our data processing storage facilities in secure locations;
• encrypting all data stored on our server with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered;
• disposing or deleting your data securely;
• regularly backing up and encrypting all data we hold.

We will ensure that our employees are aware of their privacy and data security obligations. We will take reasonable steps to ensure that the employees of third parties working on our behalf are also aware of their privacy and data security obligations.

This notice and our procedures for handling personal data will be reviewed as necessary.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the Site; any transmission is at your own risk. Once we have received your information, we will use the strict procedures and security features referred to in this clause to try to prevent unauthorised access.

HOW WE USE COOKIES

A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

An Internet Protocol (IP) address is a number assigned to your computer by your Internet Service Provider (ISP), so you can access the Internet. We may use your IP address to diagnose problems with our server, report aggregate information, and determine the fastest route for your computer to use in connecting to our Site, and to administer and improve the Site.

LINKS TO OTHER WEBSITES

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

In addition, if you came to this Site via a third party site, we cannot be responsible for the privacy policies and practices of the owners or operators of that third party site and recommend that you check the policy of that third party site and contact its owner or operator if you have any concerns or questions.

TRANSFERRING YOUR INFORMATION OUTSIDE THE UK OR EEA

As part of the services provided to you the information you provide to us may be transferred to, processed and stored at, countries or international organisations outside of the UK or European Economic Area (“EEA”).

We have customers who are outside of the UK or EEA and in those circumstances, personal data will be transferred outside of the UK or EEA (for instance to shipping partners).

We will not transfer the personal data of UK or EEA customers in a systematic way outside of the UK or EEA but there may be circumstances in which certain personal information is transferred outside of the EEA, in particular:

• If you use our Site while you are outside the UK or EEA, your information may be transferred outside the UK or EEA in order to provide you with our services;
• We may communicate with individuals or organisations outside of the UK or EEA in delivering our services, those communications may include personal information (such as contact information) for example you may be outside of the UK or EEA when we communicate with you;
• From time to time, your information may be stored in devices which are used by our staff outside of the UK or EEA (but staff will be subject to our cyber-security policies).

If we transfer your information outside of the UK or EEA, and the third country or international organisation in question has not been deemed by the EU Commission or Secretary of State (as the case may be) to have adequate data protection laws, we will provide appropriate safeguards and we will be responsible for ensuring your privacy rights continue to be protected as outlined in this notice. If you would like to obtain details of the safeguards we have put in place then please contact us at customercare@bluebella.com.

By submitting your personal information to us you agree to the transfer, storing or processing of your information outside the UK or EEA in the manner described above.

We share your data with the following categories of companies as an essential part of being able to provide our services to you, as set out in this statement:

• Mobile messaging suppliers like Attentive (read more here)
• Companies that do things to get your purchases to you, such as ecommerce providers like Shopify, payment service providers like Klarna & Amazon Pay, warehouses, order packers, and delivery companies
• Professional service providers, such as marketing agencies, advertising partners and website hosts, who help us run our business
• Credit reference agencies, law enforcement and fraud prevention agencies, so we can help tackle fraud
• Companies approved by you, such as social media sites (if you choose to link your accounts to us), marketplaces where you can place your order like La Redoute, and Apple Pay or Amazon Pay where you choose to use their payment service

We may provide third parties with aggregated but anonymised information and analytics about our customers and, before we do so, we will make sure that it does not identify you.

KLARNA

In order to be able to offer you Klarna’s payment options, we will pass to Klarna certain aspects of your personal information, such as contact and order details, in order for Klarna to assess whether you qualify for their payment options and to tailor the payment options for you.

General information on Klarna you can find here. Your personal data is handled in accordance with applicable data protection law and accordance with the information in Klarna’s privacy policy.

We engage in online advertising, both to keep you aware of what we’re up to and to help you see and find our products.

Like many companies, we target Bluebella banners and ads to you when you are on other websites and apps. We do this using a variety of digital marketing networks and ad exchanges, and we use a range of advertising technologies like web beacons, pixels, ad tags, cookies, and mobile identifiers, as well as specific services offered by some sites and social networks, such as Facebook’s Custom Audience service.

The banners and ads you see will be based on information we hold about you, or your previous use of Bluebella (for example, your Bluebella search history, and the content you read on Bluebella) or on Bluebella banners or ads you have previously clicked on.

If you have said we can, we’ll send you marketing messages by email, to keep you aware of what we’re up to and to help you see and find our products.

How to stop marketing messages from Bluebella

You can stop receiving marketing messages from us at any time. You can do this:

• By clicking "unsubscribe from this list" or "update subscription preferences" in the footer of any marketing email you receive from us
• By texting the keyword STOP to our shortcode in response to any SMS or MMS message you receive from us
• By contacting our Customer Care team

Once you do this, we will update your profile to ensure that you don’t receive further marketing messages.

Please note that, as it might take a up to 3 working days for all our systems to be updated, so you might get messages from us while we process your request.

Stopping marketing messages will not stop service communications (such as order updates and product restock notifications) or where you have expressed interest in a specific activity at Bluebella, such as the launch of new collections.

How to stop marketing messages from Marketplaces

Every Marketplace (such as La Redoute) has a separate system to ours for recording marketing preferences. We are unable to amend your preferences or unsubscribe you from their messages.

If you decide you no longer want Marketplace marketing communications, you can opt out by visiting their site and updating your preferences there, or you can click on the ‘unsubscribe’ link in any email from that Marketplace.

For the La Redoute website, you can update your preferences via the "Mes préférés" link on www.laredoute.fr

We’ll hold on to your information for as long as you have your account, or as long as is needed to be able to provide the services to you, or (in the case of any contact you may have with our Customer Care team) for as long as is necessary to provide support-related reporting and trend analysis only.

If reasonably necessary or required to meet legal or regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions, we may also keep hold of some of your information as required, even after you have closed your account or it is no longer needed to provide the services to you.

We use your personal information for a variety of reasons. We rely on different legal grounds to process your personal information, depending on the purposes of our use and the risks to your privacy. You will only receive unsolicited email and SMS marketing communications from us if: (a) we have obtained your details in the course of a sale or negotiation for a sale of our products, and you have not objected to receiving such direct email and SMS marketing from us. Of course, we will only send you marketing emails and SMS messages that are based on similar products or services that you purchased from us and you will always have the opportunity to opt out at any time; or (b) if you have consented to receiving marketing email and SMS messages from us (you can opt-out of receiving them at any time). We do not share your personal information with companies that would send their marketing to you.